Alternatives and similar repositories for cuckoo:

Users that are interested in cuckoo are comparing it to the libraries listed below

• zeek / zeek-agent-framework
  This project is no longer maintained. There's a successor at https://github.com/zeek-packages/zeek-agent-v2
  ☆14Updated 4 years ago
• corelight / zeek-quic
  Bro analyzer that detects Google's QUIC protocol
  ☆10Updated 3 years ago
• intelforge / tmc
  Threat Mapping Catalogue
  ☆17Updated 3 years ago
• OTRF / bloodhound-notebooks
  Notebooks created to attack and secure Active Directory environments
  ☆27Updated 5 years ago
• JimmyAstle / Atomic-Parser
  Python parser for Red Canary's Atomic Red Team Yamls
  ☆27Updated 5 years ago
• daniel-infosec / wikipedia-c2
  POC for utilizing wikipedia API for Command and Control
  ☆29Updated 2 years ago
• socprime / SigmaRulesIntegration
  ☆15Updated 6 years ago
• BreakingMalwareResearch / YetiToElastic
  YETI (Your Everyday Threat Intelligence) Integration to Elastic Stack
  ☆16Updated 4 years ago
• SekoiaLab / FastIR_Agent
  FastIR Agent is a Windows service to execute FastIR Collector on demand
  ☆14Updated 7 years ago
• caschnee / misp-use-cases
  ☆14Updated 6 years ago
• c2defense / windows-event-collection
  Subscriptions to collect Windows Event Logs mapped to the MITRE ATT&CK model
  ☆12Updated 4 years ago
• EmergingThreats / IDSDeathBlossom
  IDS Utility Belt For Automating/Testing Various Things
  ☆30Updated 4 years ago
• Velocidex / go-prefetch
  A golang implementation of a prefetch parser.
  ☆19Updated 4 months ago
• mitre / gocat
  Simplified go-cat agent for caldera
  ☆10Updated last year
• jipegit / IncidentsMindMaps
  Cybersecurity Incidents Mind Maps
  ☆33Updated 3 years ago
• wolfvan / YaraRET
  Carving tool based in Radare2 & Yara
  ☆16Updated 6 years ago
• opendxl / opendxl-broker
  OpenDXL Broker is an open source version of a Data Exchange Layer (DXL) broker
  ☆13Updated 11 months ago
• sisoc-tokyo / mimikatz_detection
  ☆12Updated 6 years ago
• kevthehermit / yaraMail
  Yara Scanner For IMAP Feeds and saved Streams
  ☆28Updated 5 years ago
• Beercow / ProcDOT-Plugins
  Plugins to add funtionality to ProcDOT. http://www.procdot.com
  ☆23Updated last year
• Cyb3rWard0g / docker-caldera
  Docker Container to deploy Mitre Caldera Automated Adversary Emulation System
  ☆25Updated 4 years ago
• fireeye / brocapi
  Bro PCAP Processing and Tagging API
  ☆28Updated 7 years ago
• OTRF / openhunt
  ☆33Updated 3 years ago
• nccgroup / yaml2yara
  Generate bulk YARA rules from YAML input
  ☆22Updated 4 years ago
• theparanoids / rdfp
  Remote Desktop Client Fingerprint script for Zeek. Based off of https://github.com/0x4D31/fatt
  ☆39Updated last year
• CyCat-project / cycat-taxonomy
  CyCAT.org taxonomies
  ☆14Updated 3 years ago
• StamusNetworks / surimisp
  Check IOC provided by a MISP instance on Suricata events
  ☆17Updated 5 years ago
• FuzzySecurity / BH-Arsenal-2019
  SilkETW & SilkService
  ☆40Updated 5 years ago
• Yara-Rules / YaraRET
  Carving tool based in Radare2 & Yara
  ☆15Updated 6 years ago
• exp0se / detect_kerberos_attacks
  Detect kerberos attacks in pcap files
  ☆28Updated 9 years ago